a24a82c250fe094148aaf6039e0d49d4637caa66100142c989f71880d9ee9e2b

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_d757e6a9656f43d3a4118768f240e392_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 109KB
Sample260831-dzjf2aee39
SHA256 a24a82c250fe094148aaf6039e0d49d4637caa66100142c989f71880d9ee9e2b
MD5 d757e6a9656f43d3a4118768f240e392
SHA1 898c4b861dc9f74539aec2b07f905153562a04c6
SHA512 cdbccdd1e1456bb2adf5b6f678afe080087a0fcfd1ac1a50a047fde70abf072b7d08bb7358e3d3f11263be33a25f3c70a8cdb7e060b001ef626c401d64554d8f
SSDEEP 3072:x7TeP+Oa8AFGTsZI5e+Mp+BC3K5eqU+BC3K5eqYroq:4GIAFGWIaDK70K7G
TLSH
T139B38E41F3D0DD66E05C253184A746B30BB5EC1697B135AB27883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4412	tnblvwm.exe
3100	tnblvwm.exe
6168	tnblvwm.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\tnblvwm.exe	2026-08-30_d757e6a9656f43d3a4118768f240e392_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\tnblvwm.exe	tnblvwm.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
424	4412	WerFault.exe	90
6536	6168	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_d757e6a9656f43d3a4118768f240e392_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnblvwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnblvwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnblvwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4412	tnblvwm.exe
4412	tnblvwm.exe
6168	tnblvwm.exe
6168	tnblvwm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	tnblvwm.exe
Token: SeDebugPrivilege	6168	tnblvwm.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 5520	4412	tnblvwm.exe	82
PID 6168 wrote to memory of 5520	6168	tnblvwm.exe	82

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5520
- C:\Users\Admin\AppData\Local\Temp\2026-08-30_d757e6a9656f43d3a4118768f240e392_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-30_d757e6a9656f43d3a4118768f240e392_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4088

C:\PROGRA~3\Mozilla\tnblvwm.exe
"C:\PROGRA~3\Mozilla\tnblvwm.exe" -gdtscqe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 528
  2⤵
  - Program crash
  PID:424

C:\PROGRA~3\Mozilla\tnblvwm.exe
C:\PROGRA~3\Mozilla\tnblvwm.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4412 -ip 4412
1⤵
PID:6556

C:\PROGRA~3\Mozilla\tnblvwm.exe
"C:\PROGRA~3\Mozilla\tnblvwm.exe" -gdtscqe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6168 -s 512
  2⤵
  - Program crash
  PID:6536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 6168 -ip 6168
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tnblvwm.exe

Path C:\ProgramData\Mozilla\tnblvwm.exe
Size 109KB
SHA256 9a5db0f683426124214332940c381524337566345bb1c1f4a568f611f0e55bfb
MD5 3fb817d6564358b633ef872dc5d6c99a
SHA1 add89b999eb3ef9513702f6acd1030304ad2c4ad
SHA512 26786ee6cce58ba73ef12c2d56e333a449a909b6cdee6dc4b866c57eb711b7185b6bfe17f5d19f07bd6b2bc7f0593b47585f8f550acf6b139642f8f9b8aeb630
SSDEEP 3072:x7TeP+Oa8AFGTsZI5e+Mp+BC3K5eqU+BC3K5eqYroD:4GIAFGWIaDK70K7H
TLSH
T147B38E41F3D0DD66E05C253184A746B30BB5EC1697B135AB27883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnblvwm.exe

Path C:\ProgramData\Mozilla\tnblvwm.exe
Size 109KB
SHA256 6a56a7a9b2c88af73e96164fabaf89ea2ebb436b52230d084a8a9fae02b42c49
MD5 09b7614426a6d11c6132cddd9859c1a4
SHA1 cc5bcfe93ba6fe347e3b61433546ed16ccb2f182
SHA512 d54fea4abdecde655ef48f95c4331eefe39392c731ecf19cc7255b9557c0ae4c577f37b8ce7aa2aefcfbf1721d6f5b0a89976cf3b2df571b630845988f5ee184
SSDEEP 3072:x7TeP+Oa8AFGTsZI5e+Mp+BC3K5eqU+BC3K5eqYro8:4GIAFGWIaDK70K7o
TLSH
T1B9B38E41F3D0DD66E05C253184A746B30BB5EC1697B135AB27883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3100-8-0x0000000000ED0000-0x0000000000F2F000-memory.dmp

Download

memory/4088-1-0x0000000000330000-0x000000000038F000-memory.dmp

Download

memory/4412-6-0x0000000000ED0000-0x0000000000F2F000-memory.dmp

Download

memory/5520-5-0x0000000003BA0000-0x0000000003BBC000-memory.dmp

Download

memory/6168-11-0x0000000000240000-0x000000000029F000-memory.dmp

Download